Overview of incoming advisories.
2179 results found
Google led a takedown in late October disrupting a botnet of over 1.3 million Android devices, primarily TV set-top boxes. Google asserts with high confidence that device manufacturer Videostrong intentionally embedded a backdoor in their devices and sold access to criminal actors. The compromised devices were leveraged for ad fraud and as residential proxies, routing other users' internet traffic through the infected boxes. This case represents a significant supply chain security concern as the malicious backdoor was allegedly built in at the manufacturing level. The scale of 1.3 million devices makes this one of the larger Android botnets to be disrupted.
View original advisory →BTCPay Server maintainers have issued an urgent warning to users about active cryptocurrency theft targeting hot wallets on outdated instances of the open-source payment processor. Hackers have been draining funds from installations running older versions of BTCPay Server. Users are strongly urged to update to the latest version immediately to mitigate the risk. The attacks appear to be opportunistic, targeting unpatched or outdated deployments. This highlights the risk of running self-hosted cryptocurrency infrastructure without keeping software up to date. Hot wallets, which are connected to the internet, are particularly vulnerable to such exploits. The incident underscores the importance of timely patching in financial and cryptocurrency-related software.
View original advisory →A previously overlooked TCP option known as Multipath TCP (MPTCP), introduced in 2020 via RFC 8684, has come under scrutiny due to a newly disclosed vulnerability in Linux's implementation. The vulnerability is tracked as CVE-2026-98432 and affects Linux systems utilizing the MPTCP protocol. MPTCP allows a single TCP connection to use multiple network paths simultaneously, improving redundancy and throughput. The article discusses both the use cases of Multipath TCP and methods for detecting its presence in network traffic. Security teams are advised to be aware of MPTCP-related traffic and monitor for potential exploitation attempts targeting this vulnerability.
View original advisory →Cybersecurity researchers from Dream Research Labs have disclosed a cyber espionage campaign conducted by an Iran state-aligned threat actor known as DarkBlinders, active between August and October 2026. The campaign targeted Israel and the Kurdistan Region of Iraq, resulting in the compromise of a high-profile individual in Israel and a government cloud environment in the Iraqi Kurdish region. The threat actor appears to be motivated by geopolitical interests aligned with Iran's strategic objectives in the Middle East. The campaign demonstrates sophisticated tradecraft capable of breaching both individual and government-level cloud infrastructure. This incident highlights ongoing cyber threats emanating from Iran-linked groups against regional adversaries and minority governance entities.
View original advisory →A cyberattack targeted refrigeration and cooling systems across multiple supermarket chains in several European countries. Hackers gained remote access and changed temperature settings on freezers and cooling systems, causing significant operational disruption. The attack affected multiple supermarket chains simultaneously, suggesting a coordinated or widespread campaign. The incident highlights the vulnerability of operational technology (OT) and industrial control systems (ICS) used in retail environments. Food safety and product integrity may have been compromised due to improper freezer and cooling temperatures. This event underscores the growing threat to critical infrastructure and supply chain systems beyond traditional IT environments.
View original advisory →Over 1,000 internet-exposed GitLab servers remain unpatched against a maximum-severity remote code execution vulnerability. The flaw is being actively exploited in ongoing attacks. Despite patches being available, a significant number of GitLab instances remain vulnerable. The vulnerability carries the highest possible severity rating, indicating critical risk. Organizations running GitLab are urged to apply patches immediately to prevent compromise. The exposure of these servers to the internet increases the attack surface significantly. Active exploitation suggests threat actors are already leveraging the flaw at scale.
View original advisory →Two critical vulnerabilities have been discovered in Langflow, an open-source tool used for building AI agents and workflows. The flaws could allow a remote, unauthenticated attacker to bypass authentication or execute arbitrary code on affected servers. All Langflow releases from version 1.0.0 through 1.12.8 are affected. IBM, which handles vulnerability reports for Langflow, disclosed the issues. The only remediation available is upgrading to version 1.13.0. The vulnerabilities have not yet been listed in CISA's Known Exploited Vulnerabilities catalog. The severity of these flaws is significant given that they require no authentication to exploit remotely.
View original advisory →Synology, a Taiwanese NAS appliance manufacturer, has issued a warning to customers about a surge in C3RB3R ransomware attacks targeting their network-attached storage devices. The company is urging users to immediately update their devices to protect against these ongoing attacks. C3RB3R ransomware specifically targets NAS devices, which often contain critical personal and business data. The advisory highlights the increasing trend of ransomware groups focusing on storage appliances as high-value targets. Synology customers are advised to apply available patches and follow security best practices to mitigate the risk of infection.
View original advisory →Attackers impersonating IT support staff on Microsoft Teams convinced employees to grant remote access to their computers. Once inside, they exploited misconfigured Active Directory Certificate Services (AD CS) to obtain authentication certificates for privileged accounts, including domain controllers. Microsoft investigated two separate intrusions using this technique, at least one of which resulted in significant data theft. The attack chain combines social engineering via a trusted enterprise communication platform with abuse of PKI infrastructure to escalate privileges. This highlights the risk of over-permissive AD CS configurations and the growing misuse of Microsoft Teams as an attack vector.
View original advisory →Cybersecurity researchers from Palo Alto Networks Unit 42 have uncovered a cyber espionage campaign targeting Linux infrastructure belonging to government entities and state-affiliated organizations. The campaign, tracked as CL-UNK-1211, was observed between October 2025 and April 2026. Attackers deployed a remote access trojan called SysGoRAT alongside scripts suspected to be AI-generated. The threat cluster remains unattributed ('UNK' denoting unknown origin). The campaign specifically focuses on government Linux servers, suggesting a strategic interest in sensitive government data and systems. The use of AI-generated scripts represents an emerging trend in threat actor tooling sophistication.
View original advisory →Ivanti released security updates to address two additional zero-day vulnerabilities in its Connect Secure (ICS) remote access gateway product. These flaws have been actively chained together in attacks since at least October 1. The vulnerabilities are being exploited in the wild, making them critical threats requiring immediate patching. This follows a pattern of Ivanti products being targeted by threat actors through zero-day exploitation. The chaining of vulnerabilities suggests sophisticated threat actor involvement. Organizations using Ivanti Connect Secure are urged to apply the patches immediately. The incident highlights ongoing risks in remote access and VPN gateway products.
View original advisory →Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (also known as VOLTA) that leverages large language models (LLMs) including Claude, Gemini, and Kimi AI to rank stolen victim data by monetization value. Like other stealers, VOLTA harvests passwords and cookies from Chromium-based browsers, as well as data from Outlook profiles and Slack workspaces. The novel use of AI to automatically prioritize and score victims based on their financial value represents a significant evolution in infostealer capability. This automation allows threat actors to efficiently focus their efforts on the most lucrative targets. The malware's integration of multiple commercial AI APIs suggests a well-resourced and technically sophisticated threat actor.
View original advisory →Hackers attempted to exploit a critical remote code execution (RCE) vulnerability in GitLab targeting Alpine Linux's development infrastructure on October 20-21. The attack prompted Alpine Linux to rebuild its GitLab server entirely and reset all user passwords as a precautionary measure due to concerns of a possible compromise. The incident highlights the ongoing risk of critical vulnerabilities in widely-used DevOps platforms being actively exploited against open-source project infrastructure. The nature of the vulnerability exploited was critical, suggesting it may be a known or zero-day GitLab flaw. The swift response by Alpine Linux, including server rebuilds and credential resets, indicates the team took the threat seriously and acted to prevent further damage or data exposure.
View original advisory →A critical vulnerability (CVSS 10.0) was discovered in Canonical's LXD and MicroCloud products that allows attackers to impersonate trusted clients without possessing their private key. The attack requires network access to the HTTPS API and knowledge of the trusted client's public certificate. Once authenticated as the impersonated client, the attacker gains full access to the cluster and its virtual machines. The severity of the impact depends on the privilege level of the impersonated account, potentially allowing complete cluster compromise. This flaw represents a fundamental authentication bypass in the certificate-based trust system used by LXD and MicroCloud.
View original advisory →Hackers stole approximately $2.7 million from Polymarket traders by injecting malicious code into a third-party page-speed script provided by DebugBear. The attack occurred on October 29, 2026, targeting signed-in traders by selling their positions and transferring funds to attacker-controlled wallets. A total of 726 wallets were affected, with blockchain records confirming approximately $2.64 million in crypto was moved. Polymarket has committed to refunding the affected users. This incident represents a classic supply chain attack where a trusted external script was compromised and weaponized. The attack highlights the risks of loading third-party scripts in financial and cryptocurrency platforms. No CVEs have been publicly associated with this incident at this time.
View original advisory →Cybersecurity researchers at Kaspersky have uncovered a highly sophisticated infection chain targeting government organizations across Asia. The campaign specifically targets a custom Windows 10 build used exclusively by government entities in the region. The threat involves deployment of a previously undocumented .NET assembly-loading framework codenamed NetamLoader. The malware uses .NET injection techniques to compromise systems. The targeting of government-exclusive Windows builds suggests a focused, potentially state-sponsored or advanced threat actor operation. The sophistication of the infection chain indicates significant resources and planning behind the campaign. This represents a novel malware family not previously documented in public threat intelligence.
View original advisory →On October 29, 2026, trojanized builds (versions 2.1.312 and 2.1.313) of the official Claude Code VS Code extension were published to Cursor's VS Code Extension Marketplace, targeting macOS and Windows users. The malicious extensions delivered a persistent SSH backdoor to developer machines. This represents a supply chain attack targeting developers who use the Claude Code extension within the Cursor IDE environment. The attack leveraged the trusted distribution channel of the VS Code Extension Marketplace to reach a wide audience of developers. The persistence mechanism via SSH backdoor allows attackers ongoing remote access to compromised developer machines, posing significant risks to source code, credentials, and downstream software projects.
View original advisory →Northflank, a cloud application hosting platform, suffered a security breach that resulted in unauthorized access and abuse of customers' AI API keys stored on its platform. The company is urging all customers to immediately rotate their credentials and secrets as a precautionary measure. The breach highlights risks associated with storing sensitive API keys and credentials on third-party cloud platforms. Attackers were able to leverage the exposed AI API keys, suggesting potential financial and operational impact on affected customers. The incident underscores the importance of secret management practices and the dangers of credential exposure in cloud environments.
View original advisory →A security researcher has published a proof-of-concept exploit for a recently patched Android vulnerability known as 'SMS of Death', tracked as CVE-2026-58882. The flaw allows remote attackers to disrupt cellular service or crash Android phones by sending a specially crafted SMS message. The exploit requires no user interaction beyond receiving the malicious text. Unpatched devices remain vulnerable to remote disruption. The vulnerability highlights the risk of carrier-level or baseband SMS processing flaws in Android devices. Users and organizations are urged to apply the latest Android security patches to mitigate the risk.
View original advisory →CISA has added two security vulnerabilities affecting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation in the wild. Attackers are chaining three Ivanti Connect Secure flaws to achieve unauthenticated root access. One of the key vulnerabilities is CVE-2026-111357, rated CVSS 8.8, which involves a missing authentication for a critical function. The chaining of multiple vulnerabilities amplifies the overall risk, enabling full system compromise without authentication. Organizations using Ivanti Connect Secure are urged to apply patches and mitigations immediately. The active exploitation indicates that threat actors are already leveraging these flaws in real-world attacks. CISA's KEV listing signals urgency for federal and private sector entities to remediate. This type of vulnerability chain is particularly dangerous as it bypasses standard access controls entirely.
View original advisory →